MindFlash StudioWho we are
EU Product Safety Manager is a MindFlash Studio application. The controller for studio correspondence, support and service administration is Vladimir Pogozhev, trading as MindFlash Studio, Calle Puerto Franco 41, 38410 Los Realejos, Santa Cruz de Tenerife, Spain. Contact support@mindflashstudio.com. This policy applies to this application and its product pages. The studio’s general website policy covers the wider website.
Our role and your store
For personal data supplied by a merchant to manage product safety information, the merchant is normally the controller and MindFlash Studio acts as processor on documented instructions. For our own support, security and business records, we act as controller. The Data Processing Addendum sets out the processor terms. Merely visiting this website does not install the app or provide access to a store.
Data we handle
Website delivery involves technical request data such as IP address, time, requested URL and browser details. Support involves your email address, message and any information you choose to provide. The application handles shop domains, product IDs, handles/titles, manufacturer and responsible-person names, postal/electronic contact details, countries, model identifiers, warnings, languages, review decisions and assignments. Authenticated sessions may contain administrator identity, access tokens and SDK session fields. Imports, operation journals, webhook receipt metadata and exports can contain these data.
Why we use it
We use information to deliver the website, respond to enquiries, authenticate authorised stores, manage and display safety information, validate imports, carry out requested operations, investigate problems and protect the service. Our controller bases are contract or pre-contractual steps where applicable, legitimate interests in secure operation and responding to business enquiries, and legal obligations where applicable. The merchant determines the lawful basis for its own records. We do not sell personal data, use it for advertising, train third-party AI on it, or make solely automated decisions with legal or similarly significant effects.
Public information and recipients
Merchant-configured manufacturer contacts, responsible-person details and warnings can be publicly visible on the storefront. Review this disclosure before enabling it. Shopify holds the store’s product records and app-owned metaobjects/metafields under the merchant’s Shopify relationship. Google / Firebase provides Firebase Hosting for this static website. Support email for this domain is routed through Hostinger. Necessary information may also be disclosed to authorised personnel, professional advisers or authorities where legally required.
Storage and protection
Application session payloads are encrypted in the operator-managed local store. Operational imports and change journals are readable application records and are not field-encrypted by the app; avoid unnecessary personal data. Store boundaries, official Shopify authentication and signed webhook verification protect supported workflows. Public theme output uses native Liquid. No security certification, complete immunity from incidents, or production-cloud hosting region is asserted. Merchant downloads remain on systems controlled by the merchant.
Retention and deletion
Journals become eligible for expiry after seven days; cleanup runs as operation workflows are used, so this is not a guaranteed seven-day deletion deadline. Verified uninstall removes app sessions. The shop/redact handler removes the shop’s local sessions, journal rows/jobs and webhook receipts. It does not delete merchant downloads or all Shopify-held records. Support correspondence is kept while needed to resolve the request and for proportionate follow-up, legal obligations or the establishment/defence of claims; relevance is reviewed when a case is closed or deletion is requested. Necessary security and administrative records follow the same purpose-limited criteria. Provider-controlled delivery records and copies follow the linked providers’ terms; we do not promise an unverified log or backup deletion deadline.
Cookies and browser storage
These static product pages use no optional analytics, advertising cookies, tracking pixels or embedded payment forms. The app saves a language preference in browser local storage and relies on Shopify’s authenticated session flow. Shopify, your browser and hosting/email providers have their own technical processing. Browser preferences can be cleared through browser settings; clearing them is not the same as deleting store records.
Locations and international transfers
The operator is established in Spain. Shopify, Firebase and Hostinger operate international services; this notice does not promise EU-only processing or a specific email/data-centre location. For restricted transfers we require the applicable adequacy decision or suitable safeguards, including contractual safeguards where required. Information about the safeguards applicable to your request is available from support@mindflashstudio.com. Provider details: Firebase data-processing terms, Hostinger DPA, and Shopify DPA. A new backend or processing purpose must be assessed and reflected in the applicable disclosures before it handles merchant personal data.
Your rights
Where applicable, you may request access, correction, erasure, restriction, portability, object to processing based on legitimate interests, or withdraw consent where consent is the basis without affecting earlier lawful processing. Contact support@mindflashstudio.com. We may verify identity or authority proportionately. Requests are handled within applicable legal time limits; if an extension or refusal is permitted, we explain it. For merchant-controlled records, address the merchant; we assist as processor. You can complain to your competent supervisory authority, including the Spanish AEPD.
Changes and contact
Effective 17 October 2026. Material changes to purposes, recipients or terms will be notified through appropriate service channels or the website as applicable. A change to a policy does not by itself install new infrastructure or authorise a charge. Questions: support@mindflashstudio.com.